MediaWiki cross-site scripting vulnerabilities

MediaWiki is a suite of free and freely available web-based Wiki engines from the MediaWiki Foundation. The product can be used to deploy internal knowledge management and content management systems. A security vulnerability exists in MediaWiki 1.39.3 and earlier versions, which stems from a...

CVE-2023-37302

An issue was discovered in SiteLinksView.php in Wikibase in MediaWiki through 1.39.3. There is XSS via a crafted badge title attribute. This is also related to lack of escaping in wbTemplate from resources/wikibase/templates.js for quotes which can be in a title attribute...

CVE-2023-37302

An issue was discovered in SiteLinksView.php in Wikibase in MediaWiki through 1.39.3. There is XSS via a crafted badge title attribute. This is also related to lack of escaping in wbTemplate from resources/wikibase/templates.js for quotes which can be in a title attribute...

CVE-2023-37302

An issue was discovered in SiteLinksView.php in Wikibase in MediaWiki through 1.39.3. There is XSS via a crafted badge title attribute. This is also related to lack of escaping in wbTemplate from resources/wikibase/templates.js for quotes which can be in a title attribute...

CVE-2023-37302

An issue was discovered in SiteLinksView.php in Wikibase in MediaWiki through 1.39.3. There is XSS via a crafted badge title attribute. This is also related to lack of escaping in wbTemplate from resources/wikibase/templates.js for quotes which can be in a title attribute...

CVE-2023-37302: Improper Neutralization of Input During Web Page Generation

An issue was discovered in SiteLinksView.php in Wikibase in MediaWiki through 1.39.3. There is XSS via a crafted badge title attribute. This is also related to lack of escaping in wbTemplate from resources/wikibase/templates.js for quotes which can be in a title attribute...

PT-2023-25893 · Mediawiki +1 · Mediawiki +1

Name of the Vulnerable Software and Affected Versions: MediaWiki versions through 1.39.3 Description: An issue was discovered in SiteLinksView.php in Wikibase. There is XSS via a crafted badge title attribute. This is also related to lack of escaping in wbTemplate from...

CVE-2023-30946

A security defect was identified in Foundry Issues. If a user was added to an issue on a resource that they did not have access to and consequently could not see, they could query Foundry's Notification API and receive metadata about the issue including the RID of the issue, severity, internal UU...

CVE-2023-30946

A security defect was identified in Foundry Issues. If a user was added to an issue on a resource that they did not have access to and consequently could not see, they could query Foundry's Notification API and receive metadata about the issue including the RID of the issue, severity, internal UU...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS when rendering pages in pages/actionscomponent.html.erb. A user can embed scripts in a page title via the pageencontentattributes0title parameter. PoC '" Details Cross-site scripting or XSS is a code vulnerabili...

CVE-2023-34831

The "Submission Web Form" of Turnitin LTI tool/plugin version 1.3 is affected by HTML Injection attacks. The security issue affects the submission web form "id" and "title" HTTP POST parameters where the students submit their reports for similarity/plagiarism checks...

CVE-2023-34831: Improper Neutralization of Input During Web Page Generation

The "Submission Web Form" of Turnitin LTI tool/plugin version 1.3 is affected by HTML Injection attacks. The security issue affects the submission web form "id" and "title" HTTP POST parameters where the students submit their reports for similarity/plagiarism checks...

CVE-2023-3465: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in SimplePHPscripts Classified Ads Script 1.8. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file user.php of the component HTTP POST Request Handler. The manipulation of the argument title leads to cross site...

PT-2023-25018 · Turnitin · Turnitin Lti Tool

Name of the Vulnerable Software and Affected Versions: Turnitin LTI tool/plugin version 1.3 Description: The issue affects the "Submission Web Form" of the Turnitin LTI tool/plugin, where students submit their reports for similarity/plagiarism checks. Specifically, the submission web form is...

CVE-2020-18404

An issue was discovered in espcms version P8.18101601. There is a cross site scripting XSS vulnerability that allows arbitrary code to be executed via the title parameter...

CVE-2020-18404

An issue was discovered in espcms version P8.18101601. There is a cross site scripting XSS vulnerability that allows arbitrary code to be executed via the title parameter...

CVE-2020-18404

An issue was discovered in espcms version P8.18101601. There is a cross site scripting XSS vulnerability that allows arbitrary code to be executed via the title parameter...

PT-2023-11495 · Espcms · Espcms

Name of the Vulnerable Software and Affected Versions: espcms version P8.18101601 Description: The issue allows arbitrary code to be executed via the title parameter, enabling cross-site scripting XSS. This means an attacker could inject malicious code into a website, potentially stealing user da...

CVE-2020-18404: Improper Neutralization of Input During Web Page Generation

An issue was discovered in espcms version P8.18101601. There is a cross site scripting XSS vulnerability that allows arbitrary code to be executed via the title parameter...

EARCLINK ESPCMS Cross-Site Scripting Vulnerability

Honghu Erchuang Netlink Information Technology EARCLINK ESPCMS is an enterprise website building system of China Honghu Erchuang Netlink Information Technology Company. A security vulnerability exists in EARCLINK ESPCMS version P8.18101601. An attacker exploited the vulnerability to execute...